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REMARKS 

Claims 1-18, 20-29, and 32 are pending and at issue. Of these claims 1, 11, 18, 20, 
and 29 are independent. Claims 19, 30, and 31 are canceled. 

Applicants respectfully traverse the rejection of claims 1-5, 7-15, 17, 18, 20-25, 27- 
29, and 32 as anticipated by Broadhurst et al., U.S. Patent No. 6,205,480 ("Broadhurst") and 
respectfully traverse the rejection of claims 6, 16, and 26 as obvious over Broadhurst in view 
of Brezak, Jr. et al., U.S. Patent No. 6,427,209 ("Brezak"). 

Each of the pending claims now recites a system or a method wherein security 
information is collected from a user contemporaneously with the initiation of a function and 
wherein the execution of the function is determined based on the collected security 
information. Neither Broadhurst nor Brezak discloses the collection of security information 
from a user contemporaneously with the initiation of a function in order to determine whether 
the function may be executed. As a result, neither Broadhurst nor Brezak can anticipate any 
of the pending claims. Furthermore, because no combination of Broadhurst and Brezak 
includes the element of collecting security information from a user contemporaneously with 
the initiation of a function or using this contemporaneously collected security information to 
determine whether the function may be executed, no combination of Broadhurst and Brezak 
can render any of the pending claims obvious. 

While Broadhurst discloses a method and system for automatically authenticating a 
user to applications on a network, Broadhurst does not disclose the collection of security 
information from a user contemporaneously with the initiation of a function for determining 
whether the function may be executed. Instead, similar to other known systems, Broadhurst 
collects security information from a user prior to the attempted initiation of a function by a 
user. In particular, Broadhurst discloses a system in which a user authenticates himself first 
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(and only once) by inputting login ID and password information, which information is then 
stored as a cookie. Thereafter, any subsequent need by other servers and server programs for 
that login ID and password is satisfied by accessing the cookie. Unlike the method and 
device of the pending claims, Broadhurst does not teach or disclose user interactive security 
measures placed on the initiation of functions of a process control system. Specifically, 
Broadhurst does not disclose the collection of security information from a user 
contemporaneously with the initiation of a function for determining whether the function may 
be executed. 

As a result, Broadhurst, similar to other known systems, contains a security loophole 
because, after a user logs on to a system terminal thereby completing the general system 
authentication procedure, any other person may then use the system terminal to access 
functions enabled by the logon procedure. The system and method of the pending claims, on 
the other hand, prevents unauthorized execution of critical functions by requiring collection 
of security information from the user contemporaneously with the initiation of the function 
and then using the contemporaneously collected security information to determine whether 
the function may be executed. Consequently, by using the claimed system, process critical 
functions may be protected against unauthorized execution even after a general terminal 
authentication process has been performed by an authorized user. Because Broadhurst 
discloses an automated logon process that uses a single collection procedure for the collection 
of authentication/authorization information for general access to the system, Broadhurst does 
not disclose the collection of security information from a user contemporaneously with the 
initiation of a function, as recited by the pending claims. 

As discussed in the prior office action response, Brezak also fails to disclose 
collecting security information from a user contemporaneously with the initiation of a 
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function and using this security information to determine whether the function may be 
executed. Instead, Brezak discloses a computer terminal logon and network access 
authentication process that reduces the number of network requests necessary for network 
authentication and terminal logon. The Brezak system does not, however, tie this logon 
procedure to performing a function within a process control system. In fact, after the logon 
procedure is complete, the user may implement any desired function without entering any 
contemporaneous security information. Thus, similar to the known systems, Brezak only 
collects security information for a general logon process that may allow a user to access and 
execute logon-enabled functions anytime after authentication is successfully performed. 
Brezak does not disclose, in any way, the collection of security information 
contemporaneously with the initiation of a function in order to determine whether the 
function may be executed, as recited by the pending claims. 

Moreover, neither Broadhurst nor Brezak teaches, in any manner, a security system 
that is used ? in a process control system. Broadhurst teaches a web-based, automated 
authorization scheme for simplifying authorization between multiple web servers that a user 
may access, which is not a process control system used to control, for example, a 
manufacturing process in a plant or a factory. Likewise, while Brezak discloses a computer 
terminal logon and network access authentication process that reduces the number of network ■'; 
requests necessary for network authentication and terminal logon, Brezak does not disclose or 
suggest the use of a security system in a process control system. 

Because neither Broadhurst nor Brezak discloses the collection of security 
information from a user contemporaneously with the initiation of a function in order to 
determine whether the function may be executed, as recited by each of the pending claims, or 



9 



Application No.: 09/594,678 



Docket No.: 06005/36797 



the use of a security system in a process control system, it follows that neither Broadhurst nor 
Brezak can anticipate any of the pending claims. 

Furthermore, Broadhurst and Brezak, either alone or in combination, cannot render 
any of the pending claims obvious because neither Broadhurst nor Brezak provides any 
motivation or suggestion to modify or combine their teachings to arrive at the claimed device 
or system. In fact, both Broadhurst and Brezak teach away from the claimed invention. 
Instead of teaching the collection of security information from a user contemporaneously 
with the initiation of a function, Broadhurst and Brezak disclose an automated system where 
the only security information collected from the user is collected once during an initial server 
authentication process, not contemporaneously with the initiation of a function, as recited by 
the claims. As discussed in the application and the prior office kction response, such a 
general terminal authentication process is not the function based authentication process 
recited by the pending claims of the application. Therefore, no combination of Broadhurst 
and Brezak can render any of the pending claims obvious. 
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CONCLUSION 



Applicants have now made an earnest attempt to place this case in condition for 
immediate allowance. For the foregoing reasons and for other reasons clearly apparent, 
Applicants respectfully request reconsideration and allowance of claims 1-18, 20-29, and 32. 
If there are matters that can be discussed by telephone to further the prosecution of this 
application, Applicants respectfully request that the Examiner call its attorney at the number 
listed below. 
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